JP6153031B2 - Communication system and communication method - Google Patents

Description

  The present invention relates to a communication system and a communication method in which a management apparatus communicates with a target.

  A home energy management system (HEMS) that supports energy management in a home by a controller (network management device), such as displaying optimal operation of home appliances, power generation status, and electricity usage status in real time is known.

  On the other hand, in a communication network, a technology is known in which a management device performs mutual authentication with a device using an encryption key, a public key certificate, and server information, thereby registering the device and performing encrypted communication (Patent Document). 1). In such a network, a device is registered in the management device by transmitting its information to the management device.

JP 2004-135195 A

  When performing encrypted communication to prevent eavesdropping or unauthorized access in HEMS, the management device performs predetermined authentication on the device, distributes a common encryption key, etc., and then registers and manages the device. By doing so, a protected network is configured. Generally, when a new target is authenticated and registered in the management apparatus, it is necessary to operate the management apparatus and each button of the target. However, if the location of the management device cannot be specified, the management device is installed in a difficult-to-operate location, or it is difficult to distinguish the management device from other devices due to its appearance, new objects are authenticated. , May be difficult to register.

  An object of this invention is to provide the communication system and communication method which improve the convenience at the time of registering object to a management apparatus in view of the said problem.

  In order to achieve the above object, according to a first aspect of the present invention, an authentication start request is entered by entering a registration mode for a predetermined time in response to a user operation and receiving an authentication start request from others during the registration mode. The management device that performs encrypted communication with the target by registering the authenticated target, the first device registered in the management device, and the first device that can communicate with the management device and the first device. The first device transmits a registration state notification for notifying that it is registered in the management device to the second device in response to a user operation, and is a second communication device. In response to the user's operation and the registration status notification, the device transmits to the first device a transmission request that requests the first device to transmit a transition request that requests the management device to enter the registration mode. The device responds to the transmission request. The management device enters the registration mode in response to the migration request, and the second device sends an authentication start request to the management device at the timing when the management device is in the registration mode. It is characterized by transmitting.

  The second aspect of the present invention is in a registration mode for a predetermined time in response to a user operation, and receives an authentication start request from another during the registration mode, thereby authenticating the object that has transmitted the authentication start request, In a communication system comprising a management device that performs encrypted communication with a target by registering the authenticated target, a first device registered in the management device, and a second device that can communicate with the management device and the first device, respectively. The gist of the communication method is that the first device transmits a registration status notification for notifying that it is registered in the management apparatus to the second device in response to a user operation, Transmitting a transmission request for requesting the first device to transmit a migration request for requesting the management apparatus to enter the registration mode in response to a user operation and a registration status notification; and Is required to send In response to the transmission request to the management device, the management device enters the registration mode in response to the migration request, and the second device manages at the timing when the management device is in the registration mode. And transmitting an authentication start request to the apparatus.

  ADVANTAGE OF THE INVENTION According to this invention, the communication system and communication method which improve the convenience at the time of registering object to a management apparatus by reducing operation of a management apparatus can be provided.

1 is a schematic block diagram illustrating a basic configuration of a communication system according to a first embodiment of the present invention. It is a block diagram explaining the basic composition of the NW management device with which the communications system concerning a 1st embodiment of the present invention is provided. It is a block diagram explaining the basic composition of the equipment with which the communications system concerning a 1st embodiment of the present invention is provided. It is a sequence diagram explaining the operation example of the communication system which concerns on 1st Embodiment of this invention. It is a sequence diagram explaining the operation example of the communication system which concerns on 1st Embodiment of this invention. It is a sequence diagram explaining the operation example of the communication system which concerns on 1st Embodiment of this invention. It is a typical block diagram explaining the basic composition of the communication system concerning a 2nd embodiment of the present invention. It is a sequence diagram explaining the operation example of the communication system which concerns on 2nd Embodiment of this invention.

  Next, an embodiment of the present invention will be described with reference to the drawings. In the following description of the drawings, the same or similar parts are denoted by the same or similar reference numerals, and redundant description is omitted.

(First embodiment)
As shown in FIG. 1, the communication system according to the first embodiment of the present invention includes an NW (network) management device C1, a plurality of devices D1 to D4 already registered in the NW management device C1, and an NW management device. C1 and a plurality of devices D1 to D4 and a device D5 capable of communicating with each other.

  In the example shown in FIG. 1, the NW management device (management device) C1 has a control function that forms a controller in the HEMS and a management function that forms a security group by authenticating and registering other objects (for example, devices D1 to D5). And have. The NW management device C1 performs, for example, monitoring, display, control, and the like of energy such as the amount of power used and the amount of surplus power generated by the devices D1 to D4 using the control function. The plurality of devices D <b> 1 to D <b> 5 are respectively configured from home appliances such as an air conditioner, a refrigerator, and a lighting device, and power supply devices such as a solar battery and a storage battery. The devices D1 to D5 may be devices equivalent to the NW management device C1 having at least one of a control function and a management function. When there are a plurality of devices having a management function in the same network, only the device connected first expresses the management function, and the device connected later does not express the management function.

  The NW management device C1 forms a security group SG1 protected together with the devices D1 to D4 by registering the phase devices D1 to D4 after mutual authentication with the plurality of devices D1 to D4. The NW management device C1 performs encrypted communication with each of the plurality of devices D1 to D4 in the security group SG1.

  As illustrated in FIG. 2, the NW management device C1 includes a processing unit 10, a communication unit 15 that communicates with others under the control of the processing unit 10, and an input unit 16 that receives a user operation. The communication performed by the communication unit 15 may be wireless communication or wired communication. The input unit 16 includes an input device such as a push button, for example, and inputs a signal corresponding to a user operation to the processing unit 10.

  The processing unit 10 includes a registration processing unit 11, a notification processing unit 12, and an authentication processing unit 13 as a logical structure. The registration processing unit 11 performs processing for registering the devices D <b> 1 to D <b> 5 in response to a user operation on the input unit 16. The registration processing unit 11 also performs processing for registration when another NW management device C exists. The registration processing unit 11 controls the communication unit 15 to multicast an authentication start request for requesting the start of the authentication process by itself (NW management device C1) in response to a user operation on the input unit 16. That is, the registration processing unit 11 transmits an authentication start request to other devices D1 to D5 belonging to the security group SG1.

  The notification processing unit 12 causes the communication unit 15 to transmit a redirect response (transmission request) to the devices D1 to D5 that transmitted the registration status notification in response to the redirect notification (registration status notification) transmitted from the devices D1 to D5. Control. The authentication processing unit 13 performs processing for mutual authentication with the devices D1 to D5.

  As shown in FIG. 3, the devices D1 to D5 (hereinafter simply referred to as “device D”) are respectively a processing unit 20, a communication unit 25 that communicates with others under the control of the processing unit 20, and a user. And an input unit 26 for receiving the operation. The communication performed by the communication unit 25 may be wireless communication or wired communication. The input unit 26 includes an input device such as a push button, for example, and inputs a signal corresponding to a user operation to the processing unit 20.

  The processing unit 20 includes a registration processing unit 21, a notification processing unit 22, a redirect processing unit 23, and an authentication processing unit 24 as a logical structure. The registration processing unit 21 performs processing for registration in the NW management device C1 in accordance with a user operation on the input unit 26. When the device D is a device equivalent to the NW management device C1, the registration processing unit 21, the notification processing unit 22, and the authentication processing unit 24 are equivalent to the registration processing unit 11, the notification processing unit 12, and the authentication processing unit 13, respectively. Process.

  The notification processing unit 22 generates a redirect notification (registration status notification) including the registration status of itself (each device D) and an identifier for identifying the registration-destination NW management device C1, and multicasts the generated redirect notification. 15 is controlled. That is, the notification processing unit 22 transmits a redirect notification to another device D and the NW management device C1 that belong to the security group SG1. The authentication processing unit 13 performs processing for mutual authentication with the other device D and the NW management device C1.

-Registration of device D5-
Hereinafter, in the communication system according to the first embodiment, an operation when registering the device D5 in the NW management device C1 so that the device D5 newly joins the security group SG1 will be described.

  First, an example of the operation when the installation location of the NW management device C1 is recognized by the user and is a position that can be operated by the user will be described with reference to the sequence diagram of FIG.

  In step S1, the input unit 16 of the NW management device C1 inputs a signal corresponding to the operation to the registration processing unit 11 of the NW management device C1 when operated by the user. The registration processing unit 11 of the NW management apparatus C1 enters a registration mode in which an authentication start request from another is waited for a predetermined time T1 in accordance with a user operation on the input unit 16.

  In step S2, the input unit 26 of the device D5 inputs a signal corresponding to the operation to the registration processing unit 21 of the device D5 when operated by the user. The registration processing unit 21 of the device D5 enters a registration mode in which an authentication start request from another is waited for a predetermined time T2 in accordance with a user operation on the input unit 26.

  In step S3, the registration processing unit 21 of the device D5 multicasts an authentication start request via the communication unit 25 after a predetermined time has elapsed since the input unit 26 was operated in step S2. The authentication start request includes an identifier for identifying the device D5. When the device D5 has a function equivalent to that of the NW management device C1, the main purpose is to accept an authentication start request from another device D. In this case, the device D5 does not multicast the authentication start request simultaneously with the operation, and multicasts the authentication start request after a predetermined time when it is determined that no authentication start request is transmitted from others.

  The registration processing unit 11 of the NW management device C1 advances the process to step S4 in response to receiving the authentication start request multicasted in step S3 during the predetermined time T1 in the registration mode.

  In step S4, the authentication processing unit 13 of the NW management device C1 performs authentication communication for mutual authentication with the device D5. In the authentication communication, the authentication processing unit 13 of the NW management device C1 and the authentication processing unit 24 of the device D5 mutually authenticate each other by evaluating reliability such as whether they are genuine products or sharing an encryption key. To do. In response to the mutual authentication being established, the device D5 is registered in the NW management device C1, thereby joining the security group SG1 managed by the NW management device C1 and performing encrypted communication with the NW management device C1. be able to.

  Next, referring to the sequence diagram of FIG. 5, after the user operates the device D5, the device D5 is registered in the NW management device C1 by operating any device D instead of the NW management device C1. An example of the operation when doing this will be described.

  In step S11, the input unit 26 of the device (second device) D5 inputs a signal corresponding to the operation to the registration processing unit 21 of the device D5 when operated by the user. The registration processing unit 21 of the device D5 enters a registration mode in which an authentication start request from another is waited for a predetermined time T2 in accordance with a user operation on the input unit 26.

  In step S12, the input unit 26 of the device (first device) D4 inputs a signal corresponding to the operation to the registration processing unit 21 of the device D4 when operated by the user. The registration processing unit 21 of the device D4 enters a registration mode that waits for an authentication start request from another for a predetermined time T3 in accordance with a user operation on the input unit 26.

  In step S13, the notification processing unit 22 of the device D4 receives an identifier for identifying the registration state of the device D4 and the NW management device C1 that is the registration destination simultaneously with the operation in accordance with the operation of the user input unit 26 in step S12. Multicast redirect notifications that contain it. That is, the device D4 multicasts a redirect notification that notifies that the signal for performing authentication with the NW management device C1 is already registered in the NW management device C1 and can be redirected.

  The redirect notification (registration status notification) can be included in, for example, an authentication start request that the device D4 requests to start authentication processing. That is, the notification processing unit 22 of the device D4 may multicast the authentication start request including the redirect notification in step S13. Accordingly, the redirect notification can be transmitted as a general authentication start request, and can be easily extended to existing devices.

  In step S14, the notification processing unit 22 of the device D5 receives a redirect notification in step S13 during a predetermined time T2 when the NW management device C2 is in the registration mode, and a redirect response (transmission request). Is transmitted to the device D4. The redirect response is a message that the device D5 requests the device D4 to transmit a redirect authentication start request (migration request) that requests the NW management device C1 identified by the identifier included in the redirect notification to enter the registration mode. is there.

  In step S15, the redirect processing unit 23 of the device D4 transmits a redirect authentication start request (migration request) requesting the NW management device C1 to enter the registration mode in response to the redirect response transmitted in step S14. The redirect authentication start request includes an identifier for identifying the device D5 that has transmitted the redirect response. The registration processing unit 11 of the NW management device C1 enters the registration mode for a predetermined time T1 in response to receiving the redirect authentication start request transmitted in step S15.

  In step S16, the registration processing unit 21 of the device D5 transmits an authentication start request to the NW management device C1 at a timing when the NW management device C1 is predicted to be in the registration mode. For example, the registration processing unit 21 of the device D5 may transmit an authentication start request after a predetermined time has elapsed since the transmission of the redirect response in step S14. Further, in response to the redirect authentication start request in step S15, the NW management device C1 transmits a transition notification notifying that it has shifted to the registration mode to the device D4, and transmits a transition notification received by the device D4 to the device D5. It may be. In this case, the registration processing unit 21 of the device D5 may transmit an authentication start request after a predetermined time has elapsed from the reception of the transfer notification.

  The registration processing unit 11 of the NW management device C1 advances the process to step S17 in response to receiving the authentication start request transmitted in step S16 during the predetermined time T1 in the registration mode.

  In step S17, the authentication processing unit 13 of the NW management device C1 performs authentication communication for mutual authentication with the device D5. The description of the subsequent operation is substantially the same as the description of step S4 in FIG.

  Next, referring to the sequence diagram of FIG. 6, after the user operates one of the devices D instead of the NW management device C1, the device D5 is operated to register the device D5 in the NW management device C1. An example of the operation when doing this will be described.

  In step S201, the input unit 26 of the device D4 inputs a signal corresponding to the operation to the registration processing unit 21 of the device D4 when operated by the user. The registration processing unit 21 of the device D4 enters a registration mode that waits for an authentication start request from another for a predetermined time T3 in accordance with a user operation on the input unit 26.

  In step S202, the notification processing unit 22 of the device D4 multicasts a redirect notification including an identifier for identifying the registration state of the device D4 and the NW management device C1 that is the registration destination simultaneously with the operation of the user input unit 26 in step S12. To do.

  In step S203, the device D5 receives the redirect notification transmitted in step S202, but discards the redirect notification because it is not in the registration mode.

  In step S204, the input unit 26 of the device D5 inputs a signal corresponding to the operation to the registration processing unit 21 of the device D5 when operated by the user. The registration processing unit 21 of the device D5 enters a registration mode in which an authentication start request from another is waited for a predetermined time T2 in accordance with a user operation on the input unit 26.

  In step S205, the registration processing unit 21 of the device D5 multicasts an authentication start request via the communication unit 25 every predetermined time after the input unit 26 is operated in step S204.

  In step S206, the registration processing unit 21 of the device D4 transmits the authentication start request in response to receiving the authentication start request multicasted in step S205 during the predetermined time T3 in the registration mode. A redirect notification is sent to D5.

  In step S207, the notification processing unit 22 of the device D5 transmits a redirect response (transmission request) to the device D4 that has transmitted the redirect notification in response to receiving the redirect notification of step S206.

  In step S208, the redirect processing unit 23 of the device D4 transmits a redirect authentication start request (migration request) requesting the NW management apparatus C1 to enter the registration mode in response to the redirect response transmitted in step S207. The registration processing unit 11 of the NW management device C1 enters the registration mode for a predetermined time T1 in response to receiving the redirect authentication start request transmitted in step S208.

  The description of the operations in steps S209 to S210 is substantially the same as the description of steps S16 to S17 in FIG.

  According to the communication system according to the first embodiment of the present invention, even if the user cannot identify the location of the NW management device C1 or the NW management device C1 is installed in a location where operation is difficult. The device D5 can be easily registered in the NW management device C1. Since the communication system according to the first embodiment of the present invention can perform authentication and registration of the device D5 by omitting the operation of the NW management device C1, the convenience when registering the target in the NW management device C1 is improved. can do.

(Second Embodiment)
The device D5 of the first embodiment is an NW management device C2 that is equivalent to the NW management device C1, and after the NW management device C2 joins the security group SG1, a new device is called the NW management device C1. The case where it is installed in an environment where communication is not possible will be described. That is, the communication system according to the second embodiment of the present invention is the first implementation in that a plurality of devices D1 to D4 and the NW management device C2 are already authenticated by the NW management device C1, as shown in FIG. Different from form. The configuration of each unit of the NW management device C2 is the same as that of the NW management device C1. Other configurations, operations, and effects that are not described in the second embodiment are substantially the same as those in the first embodiment and are omitted because they overlap.

  In the second embodiment, the NW management device C1 is protected together with the plurality of devices D1 to D4 and the NW management device C2 by registering after mutual authentication with the plurality of devices D1 to D4 and the NW management device C2. SG2 is configured.

  The communication system according to the second embodiment further includes a device D6 located in an environment incapable of communicating with the NW management devices C1 and C2 and the devices D1 to D4 constituting the security group SG2. The device D6 has the same configuration as the other devices D1 to D4.

-Registration of device D5-
Hereinafter, with reference to the sequence diagram of FIG. 8, in the communication system according to the second embodiment, an operation when registering the device D6 in the NW management device C1 in order for the device D6 to join the security group SG2 will be described. .

  For example, in a newly built or renovated residence, the device D6 needs to be installed at a position away from the NW management device C1, such as another floor of the security group SG2 that has already been constructed, and the communication line for the device D6 There is a possibility that has not been prepared yet. In this case, if registration can be completed at the time of installation of the device D6, the device D6 can be joined to the security group SG2 along with the opening of the communication line, and the user's labor can be reduced.

  In step S301, the NW management device C2 disconnects from the NW management device C1 and is in a state where it can communicate with the device D6. The NW management device C2 is communicably connected to the device D6, for example, by being moved close to the device D6 or connected to the device D6 by a communication cable.

  In step S302, the input unit 16 of the NW management device C2 inputs a signal corresponding to the operation to the registration processing unit 11 of the NW management device C2 when operated by the user. The registration processing unit 11 of the NW management apparatus C2 enters a registration mode in which an authentication start request from another is waited for a predetermined time T2 in accordance with a user operation on the input unit 16.

  In step S303, the input unit 26 of the device D6 inputs a signal corresponding to the operation to the registration processing unit 21 of the device D6 when operated by the user. The registration processing unit 21 of the device D6 enters a registration mode in which an authentication start request from another is waited for a predetermined time T4 in response to a user operation on the input unit 26.

  In step S304, the registration processing unit 21 of the device D6 multicasts an authentication start request via the communication unit 25 at the same time as the operation in response to the user's operation on the input unit 26 in step S303. The authentication start request includes an identifier for identifying the device D6.

  The registration processing unit 11 of the NW management apparatus C2 advances the process to step S305 in response to receiving the authentication start request multicasted in step S304 during the predetermined time T2 in the registration mode.

  In step S305, the authentication processing unit 13 of the NW management device C2 performs authentication communication for mutual authentication with the device D6. In the authentication communication, the authentication processing unit 24 of the device D6 and the authentication processing unit 13 of the NW management device C2 evaluate reliability such as whether they are genuine products or share a common encryption key with the NW management device C1. To authenticate each other. In response to the establishment of the mutual authentication, the device D6 temporarily joins the group managed by the NW management device C2.

  In step S306, the NW management device C2 is disconnected from the device D6 and is connected to the NW management device C1 so as to be communicable again.

  In step S307, the registration processing unit 11 of the NW management device C2 requests temporary registration of the device D6 registered in the NW management device C2 in response to being connected to be communicable with the NW management device C1. Is transmitted to the NW management device C1.

  In step S308, the registration processing unit 11 of the NW management apparatus C1 temporarily registers the device D6 identified by the identifier included in the temporary registration request transmitted in step S307. After step S308, the registration processing unit 11 of the NW management device C1 maintains provisional registration of the device D6 until a communication line with the device D6 is prepared and a connection notification is transmitted from the device D6.

  In step S309, the registration processing unit 11 of the NW management apparatus C1 transmits a temporary registration response notifying that the temporary registration of the device D6 has been completed to the NW management apparatus C2.

  When the device D6 is communicably connected to the NW management device C1 in step S310, in step S311, the registration processing unit 21 of the device D6 notifies that the device D6 is communicably connected to the NW management device C1. Multicast The connection notification includes an identifier for identifying the device D6.

  The registration processing unit 11 of the NW management device C1 determines whether the identifier of the temporarily registered device D6 matches the identifier included in the connection notification in response to receiving the multicast connection notification in step S311. Determine whether.

  If the identifiers match, the authentication processing unit 13 of the NW management apparatus C1 registers the device D6 that transmitted the connection notification, and transmits a notification response indicating that the device D5 has been registered to the device D6 in step S312. If the identifiers do not match, the registration processing unit 11 of the NW management device C1 discards the connection notification.

  In response to receiving the notification response, the device D6 can join the security group SG2 managed by the NW management device C1 and perform encrypted communication with the NW management device C1.

  According to the communication system according to the second embodiment of the present invention, even when the device D6 is installed in an environment where a communication line is not yet prepared, the device D6 is managed by the NW management device C2. Temporary registration can be performed in the device C1. As a result, when the communication environment of the device D6 is ready, the operation of the NW management device C1 can be omitted and the device D6 can be registered, so that the convenience for registering the target in the NW management device C1 is improved. be able to.

(Other embodiments)
As described above, the present invention has been described according to the first and second embodiments. However, it should not be understood that the descriptions and drawings constituting a part of this disclosure limit the present invention. From this disclosure, various alternative embodiments, examples and operational techniques will be apparent to those skilled in the art.

  For example, in the first embodiment already described, the device D5 may hold the redirect notification for a predetermined time in step S203 of FIG. 6 without discarding the redirect notification. In this case, in response to the operation of the input unit 26 in step S204, the device D5 can perform subsequent processing by assuming that the held redirect notification is received during the registration mode. Thereby, the user can perform an operation without being aware of the order of the device D5 and the device D4.

  In the first and second embodiments already described, the NW management device C and the device D may include a notification unit that notifies the user by voice, light, or the like that the registration mode is in progress. Thereby, the user can recognize that the NW management device C and the device D are in the registration mode even when the operation of the NW management device C and the device D is difficult.

  As described above, the present invention naturally includes various embodiments not described herein. Therefore, the technical scope of the present invention is defined only by the invention specifying matters according to the scope of claims reasonable from the above description.

C1 NW management device (management device)
C2 NW management device D1-D3 equipment D4 equipment (first equipment)
D5 equipment (second equipment)
D6 equipment (new equipment)

Claims (6)

The registration mode is entered for a predetermined time according to the user's operation, and the authentication start request is received from others during the registration mode to authenticate the object that has transmitted the authentication start request and register the authenticated object A management device for performing encrypted communication with the target,
A first device registered in the management device;
A communication system comprising the management device and a second device that can communicate with the first device,
In response to a user operation, the first device transmits a registration status notification for notifying that the first device is registered in the management device,
In response to a user operation and the registration status notification, the second device sends a transmission request requesting the first device to transmit a transition request for requesting the management apparatus to enter the registration mode. Send it to one device,
In response to the transmission request, the first device transmits the migration request to the management device,
In response to the migration request, the management device enters the registration mode,
The communication system, wherein the second device transmits the authentication start request to the management device at a timing when the management device is in the registration mode. The second device transmits the authentication start request to the first device in response to a user operation,
The first device, a communication system according to claim 1, wherein the authentication start request in response to receiving from the second device, and transmits the registration state notification to the second device. The second device enters a registration mode for a predetermined time according to a user operation, and when the registration status notification is received from the first device during the registration mode, the transmission request is sent to the first device. The communication system according to claim 1 , wherein the transmission is performed. The second device enters a registration mode for a predetermined time in response to a user operation, and receives the registration status notification before a predetermined time before entering the registration mode. communication system according to claim 1, characterized by transmitting to the first device a request. The management device authenticates the second device, receives an identifier for identifying a new device authenticated by the second device from the second device, and notifies that the connection has been established with the management device. The communication system according to any one of claims 1 to 4 , wherein the new device is registered when a connection notification to be received is received from the new device. The registration mode is entered for a predetermined time according to the user's operation, and the authentication start request is received from others during the registration mode to authenticate the object that has transmitted the authentication start request and register the authenticated object A communication method in a communication system comprising: a management device that performs encrypted communication with the target; a first device registered in the management device; and a second device that can communicate with the management device and the first device. Because
The first device transmits a registration status notification for notifying that it is registered in the management device to the second device in response to a user operation;
In response to a user operation and the registration status notification, the second device sends a transmission request requesting the first device to transmit a transition request for requesting the management apparatus to enter the registration mode. Sending to one device,
The first device transmits the migration request to the physical device in response to the transmission request;
The management device enters the registration mode in response to the migration request;
The second device includes: transmitting the authentication start request to the management device at a timing when the management device is in the registration mode.

Images